larvit/fejkdata
3
0
Fork 0
Code Pull Requests 1 Actions Activity

Answer architecture round 2: 1 🔴, 3 🟡; read the report and edit the plan in two functions, propose only while no pull request is open, and test filing into the repository's own todo.md

Browse Source
This commit is contained in:
Lilleman auf Larv
2026-10-14 13:03:56 +02:00
committed by Lillem4n
parent 273dd45128
commit 2d86f4f0c0
9 changed files with 209 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
release-tooling/file_vulnerabilities_test.py
+82 -49
View File
@@ -35,17 +35,6 @@ TODO = """# todo
Why.
"""
def report(*findings, osvs=()):
messages = [{"config": {"go_version": "go1.27.1", "scan_level": "module"}}]
messages += [{"osv": osv} for osv in osvs]
messages += [
{"finding": {"osv": osv, "fixed_version": fixed, "trace": [{"module": module, "version": version}]}}
for osv, module, version, fixed in findings
]
return "\n".join(json.dumps(m, indent=2) for m in messages)
OSVS = (
{"id": "GO-2026-0002", "summary": "Denial of service in net/http", "aliases": ["CVE-2026-2"]},
{"id": "GO-2026-0001", "summary": "Cross-site scripting in html/template", "aliases": ["CVE-2026-1"]},
@@ -56,51 +45,94 @@ STDLIB = (
("GO-2026-0001", "stdlib", "v1.27.1", "v1.27.10"),
("GO-2026-0001", "stdlib", "v1.27.1", "v1.27.10"),
)
TEXT = (("GO-2026-0003", "golang.org/x/text", "v0.3.0", "v0.3.8"),)
GO_TAGLINE = "Raise Go to 1.27.10, so the release binaries carry none of Go 1.27.1's known vulnerabilities."
def report(*findings):
messages = [{"config": {"go_version": "go1.27.1", "scan_level": "module"}}]
messages += [{"osv": osv} for osv in OSVS]
for osv, module, version, fixed in findings:
finding = {"osv": osv, "trace": [{"module": module, "version": version}]}
if fixed:
finding["fixed_version"] = fixed
messages.append({"finding": finding})
return "\n".join(json.dumps(m, indent=2) for m in messages)
def file(todo, *findings):
return file_vulnerabilities.file_items(file_vulnerabilities.vulnerable_modules(report(*findings)), todo)
def rows(todo):
return [line for line in todo.splitlines() if "| **" in line]
class FileItems(unittest.TestCase):
def test_no_finding_files_nothing(self):
self.assertEqual(file_vulnerabilities.file_items(report(osvs=OSVS), TODO), (TODO, 0))
self.assertEqual(file(TODO), (TODO, []))
def test_files_one_security_item_per_module_at_the_top_of_the_next_release(self):
todo, found = file_vulnerabilities.file_items(report(*STDLIB, osvs=OSVS), TODO)
self.assertEqual(found, 2)
def test_files_one_security_item_per_module_atop_the_next_release(self):
todo, filed = file(TODO, *STDLIB)
self.assertEqual(filed, [7])
self.assertIn("`Next ID = 8`", todo)
rows = [line for line in todo.splitlines() if "| **" in line]
self.assertEqual(
rows[0],
"| 7 | 0.2.0 | security | **Raise Go to 1.27.10, so the release binaries carry none of"
" its known vulnerabilities.** | 1 | 1 | 1 | 8 | 8 | 1.1 | 29.1 |",
)
self.assertTrue(rows[1].startswith("| 5 |"))
detail = todo.split("## Details\n\n", 1)[1]
self.assertEqual(rows(todo)[0], f"| 7 | 0.2.0 | security | **{GO_TAGLINE}** | 1 | 1 | 1 | 8 | 8 | 1.1 | 29.1 |")
self.assertTrue(rows(todo)[1].startswith("| 5 |"))
self.assertTrue(
detail.startswith(
"### 7. Raise Go to 1.27.10, so the release binaries carry none of its known vulnerabilities.\n\n"
todo.split("## Details\n\n", 1)[1].startswith(
f"### 7. {GO_TAGLINE}\n\n"
"govulncheck found these in Go 1.27.1:\n\n"
"- GO-2026-0001 (CVE-2026-1): Cross-site scripting in html/template\n"
"- GO-2026-0002 (CVE-2026-2): Denial of service in net/http\n\n"
),
detail,
"### 5. Add a thing."
)
)
self.assertIn("### 5. Add a thing.", detail)
def test_a_module_requirement_gets_its_own_item(self):
findings = STDLIB + (("GO-2026-0003", "golang.org/x/text", "v0.3.0", "v0.3.8"),)
todo, found = file_vulnerabilities.file_items(report(*findings, osvs=OSVS), TODO)
self.assertEqual(found, 3)
self.assertIn("| 8 | 0.2.0 | security | **Raise `golang.org/x/text` to v0.3.8, so the module requires none of its known vulnerabilities.** |", todo)
self.assertIn("- GO-2026-0003: Panic in x/text\n", todo)
def test_a_required_module_gets_its_own_item(self):
todo, filed = file(TODO, *STDLIB, *TEXT)
self.assertEqual(filed, [7, 8])
self.assertIn(
"| 8 | 0.2.0 | security | **Raise `golang.org/x/text` to v0.3.8, so fejkdata requires no version"
" of it with a known vulnerability.** |",
todo,
)
self.assertIn("govulncheck found these in `golang.org/x/text` v0.3.0:\n\n- GO-2026-0003: Panic in x/text\n", todo)
self.assertIn("`Next ID = 9`", todo)
def test_a_vulnerability_already_planned_is_not_filed_again(self):
filed, _ = file_vulnerabilities.file_items(report(*STDLIB, osvs=OSVS), TODO)
self.assertEqual(file_vulnerabilities.file_items(report(*STDLIB, osvs=OSVS), filed), (filed, 2))
planned, _ = file(TODO, *STDLIB)
self.assertEqual(file(planned, *STDLIB), (planned, []))
def test_a_module_newly_vulnerable_is_filed_beside_one_already_planned(self):
planned, _ = file(TODO, *STDLIB)
todo, filed = file(planned, *STDLIB, *TEXT)
self.assertEqual(filed, [8])
self.assertIn("| 8 | 0.2.0 | security | **Raise `golang.org/x/text`", todo)
def test_a_vulnerability_no_version_fixes_names_no_target(self):
todo, _ = file(TODO, *STDLIB, ("GO-2026-0003", "stdlib", "v1.27.1", ""))
self.assertIn(
"| 7 | 0.2.0 | security | **Ship no release while fejkdata carries Go 1.27.1, some of whose known"
" vulnerabilities no version fixes yet.** |",
todo,
)
def test_a_plan_with_no_items_is_refused(self):
empty = TODO.split("| 5 |")[0].rstrip("\n") + "\n\n## Details\n"
with self.assertRaises(SystemExit):
file_vulnerabilities.file_items(report(*STDLIB, osvs=OSVS), empty)
with self.assertRaises(ValueError):
file(empty, *STDLIB)
def test_the_repositorys_plan_takes_an_item_in_its_own_shape(self):
path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "todo.md")
with open(path, encoding="utf-8") as f:
plan = f.read()
todo, filed = file(plan, *STDLIB)
header = next(line for line in plan.splitlines() if line.startswith("| ID |"))
row = rows(todo)[0]
self.assertEqual(row.count("|"), header.count("|"))
self.assertEqual(row.split(" | ")[1], rows(plan)[0].split(" | ")[1])
self.assertRegex(row, rf"^\| {filed[0]} \| .* \| \d+\.\d \|$")
self.assertIn(f"`Next ID = {filed[0] + 1}`", todo)
class Main(unittest.TestCase):
@@ -113,9 +145,9 @@ class Main(unittest.TestCase):
with open("todo.md", "w", encoding="utf-8") as f:
f.write(TODO)
def run_main(self, text):
def run_main(self, *findings):
with open("report.json", "w", encoding="utf-8") as f:
f.write(text)
f.write(report(*findings))
out = io.StringIO()
with redirect_stdout(out):
code = file_vulnerabilities.main(["report.json", "todo.md"])
@@ -123,19 +155,20 @@ class Main(unittest.TestCase):
return code, out.getvalue(), f.read()
def test_a_clean_report_passes_and_leaves_the_plan(self):
self.assertEqual(self.run_main(report(osvs=OSVS)), (0, "No known vulnerabilities.\n", TODO))
self.assertEqual(self.run_main(), (0, "No known vulnerabilities.\n", TODO))
def test_a_finding_fails_and_files_it(self):
code, out, todo = self.run_main(report(*STDLIB, osvs=OSVS))
self.assertEqual(code, 1)
self.assertEqual(out, "2 known vulnerabilities; todo.md item 7 plans the fix.\n")
code, out, todo = self.run_main(*STDLIB)
self.assertEqual((code, out), (1, "2 known vulnerabilities; todo.md item 7 plans the fix.\n"))
self.assertIn("| 7 | 0.2.0 | security |", todo)
def test_a_finding_already_planned_still_fails(self):
self.run_main(report(*STDLIB, osvs=OSVS))
code, out, _ = self.run_main(report(*STDLIB, osvs=OSVS))
self.assertEqual(code, 1)
self.assertEqual(out, "2 known vulnerabilities, already planned in todo.md.\n")
def test_findings_in_two_modules_name_both_items(self):
_, out, _ = self.run_main(*STDLIB, *TEXT)
self.assertEqual(out, "3 known vulnerabilities; todo.md items 7, 8 plan the fix.\n")
def test_one_finding_already_planned_still_fails(self):
self.run_main(*TEXT)
self.assertEqual(self.run_main(*TEXT)[:2], (1, "1 known vulnerability, already planned in todo.md.\n"))
if __name__ == "__main__":